kalup 0.5.0 → 0.6.0

package/dist/{commands-D_Q8-jc5.mjs → commands-DdogKJKg.mjs}

@@ -108,7 +108,7 @@ var ir_1_schema_default = {
 	$schema: "https://json-schema.org/draft/2020-12/schema",
 	$id: "https://kalup.dev/schemas/ir-1.schema.json",
 	title: "Kalup IR, version 1",
-	description: "What a Kalup project's config files mean, derived by `kalup ir`, or what a portal holds, captured by `kalup snapshot` with an observation block. Change inside a version is additive and readers keep unknown fields, so the document and each resource accept fields this schema does not list. Below a resource everything is closed except `x` and the definition of a resource type this schema does not describe, which stays open until a later ir/1 release describes that type.",
+	description: "What a Kalup project's config files mean, derived by `kalup ir`, or what a portal holds, captured by `kalup snapshot` with an observation block. Open for additions within ir/1 (docs/compatibility.md): the document, each resource and everything below it accept fields this schema does not list, and readers keep or ignore them; a later 1.x may add a resource type, and a reader reports an address of a type it does not handle as unknown. Closed, because a new value changes what a reader may conclude: generator, a $ref, a tombstone, the read statuses in coverage, lifecycle.options, and a target's drift and adopt.",
 	type: "object",
 	required: [
 		"irVersion",
@@ -264,29 +264,14 @@ var ir_1_schema_default = {
 			"properties": {
 				"label": { "type": "string" },
 				"group": { "$ref": "#/$defs/ref" },
-				"type": { "enum": [
-					"string",
-					"number",
-					"bool",
-					"date",
-					"datetime",
-					"enumeration",
-					"phone_number"
-				] },
-				"fieldType": { "enum": [
-					"text",
-					"textarea",
-					"file",
-					"phonenumber",
-					"number",
-					"booleancheckbox",
-					"select",
-					"radio",
-					"checkbox",
-					"date",
-					"html",
-					"calculation_equation"
-				] },
+				"type": {
+					"type": "string",
+					"description": "A value HubSpot defines; known values: string, number, bool, date, datetime, enumeration, phone_number. A later version may record one HubSpot adds."
+				},
+				"fieldType": {
+					"type": "string",
+					"description": "A value HubSpot defines; known values: text, textarea, file, phonenumber, number, booleancheckbox, select, radio, checkbox, date, html, calculation_equation. A later version may record one HubSpot adds."
+				},
 				"description": { "type": "string" },
 				"options": {
 					"type": "array",
@@ -299,36 +284,25 @@ var ir_1_schema_default = {
 					"type": "integer",
 					"minimum": -1
 				},
-				"numberDisplayHint": { "enum": [
-					"currency",
-					"duration",
-					"formatted",
-					"percentage",
-					"probability",
-					"unformatted"
-				] },
+				"numberDisplayHint": {
+					"type": "string",
+					"description": "A value HubSpot defines; known values: currency, duration, formatted, percentage, probability, unformatted. A later version may record one HubSpot adds."
+				},
 				"showCurrencySymbol": { "type": "boolean" },
 				"currencyPropertyName": { "type": "string" },
-				"textDisplayHint": { "enum": [
-					"domain_name",
-					"email",
-					"ip_address",
-					"multi_line",
-					"phone_number",
-					"physical_address",
-					"postal_code",
-					"unformatted_single_line"
-				] },
+				"textDisplayHint": {
+					"type": "string",
+					"description": "A value HubSpot defines; known values: domain_name, email, ip_address, multi_line, phone_number, physical_address, postal_code, unformatted_single_line. A later version may record one HubSpot adds."
+				},
 				"calculationFormula": { "type": "string" },
-				"dataSensitivity": { "enum": [
-					"non_sensitive",
-					"sensitive",
-					"highly_sensitive"
-				] },
+				"dataSensitivity": {
+					"type": "string",
+					"description": "A value HubSpot defines; known values: non_sensitive, sensitive, highly_sensitive. A later version may record one HubSpot adds."
+				},
 				"externalOptions": { "const": true },
 				"referencedObjectType": { "const": "OWNER" }
 			},
-			"additionalProperties": false
+			"additionalProperties": true
 		},
 		"option": {
 			"description": "One enumeration option. Array index is display order. The app alias lives in binding.aliases, never here.",
@@ -340,13 +314,14 @@ var ir_1_schema_default = {
 				"hidden": { "type": "boolean" },
 				"description": { "type": "string" }
 			},
-			"additionalProperties": false
+			"additionalProperties": true,
+			"patternProperties": { "^as$": false }
 		},
 		"groupDefinition": {
 			"type": "object",
 			"required": ["label"],
 			"properties": { "label": { "type": "string" } },
-			"additionalProperties": false
+			"additionalProperties": true
 		},
 		"objectDefinition": {
 			"description": "A custom object schema. Its properties and groups are resources of their own.",
@@ -360,7 +335,7 @@ var ir_1_schema_default = {
 						"singular": { "type": "string" },
 						"plural": { "type": "string" }
 					},
-					"additionalProperties": false
+					"additionalProperties": true
 				},
 				"description": { "type": "string" },
 				"primaryDisplayProperty": { "type": "string" },
@@ -377,7 +352,7 @@ var ir_1_schema_default = {
 					"items": { "type": "string" }
 				}
 			},
-			"additionalProperties": false
+			"additionalProperties": true
 		},
 		"pipelineDefinition": {
 			"description": "A pipeline. Its stages are resources of their own; stages lists their IDs in display order.",
@@ -398,7 +373,7 @@ var ir_1_schema_default = {
 					"items": { "type": "string" }
 				}
 			},
-			"additionalProperties": false
+			"additionalProperties": true
 		},
 		"stageDefinition": {
 			"description": "A pipeline stage. Its metadata field depends on the object: probability on deals, ticketState on tickets, state on custom objects.",
@@ -411,10 +386,16 @@ var ir_1_schema_default = {
 					"minimum": 0,
 					"maximum": 1
 				},
-				"ticketState": { "enum": ["OPEN", "CLOSED"] },
-				"state": { "enum": ["OPEN", "CLOSED"] }
+				"ticketState": {
+					"type": "string",
+					"description": "A value HubSpot defines; known values: OPEN, CLOSED. A later version may record one HubSpot adds."
+				},
+				"state": {
+					"type": "string",
+					"description": "A value HubSpot defines; known values: OPEN, CLOSED. A later version may record one HubSpot adds."
+				}
 			},
-			"additionalProperties": false
+			"additionalProperties": true
 		},
 		"associationDefinition": {
 			"description": "An association label between two objects: label as the from object shows it, inverseLabel as the to object does. With neither, the plain association of a pair that has no HubSpot-defined one.",
@@ -423,26 +404,18 @@ var ir_1_schema_default = {
 				"label": { "type": "string" },
 				"inverseLabel": { "type": "string" }
 			},
-			"additionalProperties": false
+			"additionalProperties": true
 		},
 		"binding": {
 			"description": "App terms, filled in by the loader. key and codec for properties, export for objects.",
 			"type": "object",
 			"properties": {
 				"key": { "type": "string" },
-				"codec": { "enum": [
-					"string",
-					"number",
-					"boolean",
-					"date",
-					"datetime",
-					"enum",
-					"multiEnum",
-					"stringArray",
-					"json",
-					"phoneNumber",
-					"owner"
-				] },
+				"codec": {
+					"type": "string",
+					"pattern": "^[a-zA-Z]+$",
+					"description": "The builder. Known: string, number, boolean, date, datetime, enum, multiEnum, stringArray, json, phoneNumber, owner. A later version may add a builder."
+				},
 				"aliases": {
 					"type": "object",
 					"additionalProperties": { "type": "string" }
@@ -452,7 +425,7 @@ var ir_1_schema_default = {
 				"strict": { "type": "boolean" },
 				"export": { "type": "string" }
 			},
-			"additionalProperties": false
+			"additionalProperties": true
 		},
 		"lifecycle": {
 			"type": "object",
@@ -469,7 +442,7 @@ var ir_1_schema_default = {
 				},
 				"preventDestroy": { "type": "boolean" }
 			},
-			"additionalProperties": false
+			"additionalProperties": true
 		},
 		"provenance": {
 			"description": "Merged from blueprints.lock.json in the folder of object files by the loader. Absent means authored by hand.",
@@ -488,7 +461,7 @@ var ir_1_schema_default = {
 				"prefix": { "type": "string" },
 				"hash": { "type": "string" }
 			},
-			"additionalProperties": false
+			"additionalProperties": true
 		},
 		"target": {
 			"description": "One named portal. Credentials never enter the IR.",
@@ -521,7 +494,8 @@ var ir_1_schema_default = {
 					"additionalProperties": false
 				}
 			},
-			"additionalProperties": false
+			"additionalProperties": true,
+			"patternProperties": { "^credentials$": false }
 		},
 		"override": {
 			"type": "object",
@@ -534,7 +508,7 @@ var ir_1_schema_default = {
 					"additionalProperties": { "type": "string" }
 				}
 			},
-			"additionalProperties": false
+			"additionalProperties": true
 		},
 		"observation": {
 			"description": "What a snapshot read: the target, when, and how completely. A portal-frontend document requires it. observedAt is the one timestamp an ir/1 document carries.",
@@ -564,7 +538,7 @@ var ir_1_schema_default = {
 				},
 				"coverage": { "$ref": "#/$defs/coverage" }
 			},
-			"additionalProperties": false
+			"additionalProperties": true
 		},
 		"coverage": {
 			"description": "What the read covered. Only a complete read proves that a resource is absent.",
@@ -589,44 +563,38 @@ var ir_1_schema_default = {
 					"if": { "type": "string" },
 					"then": { "const": "unknown" }
 				},
+				"settling": {
+					"description": "Resources the read cannot be trusted on yet, by address: apply wrote them minutes ago and HubSpot still serves an older copy (stale), or does not list one Kalup created (missing). Unknown until the time given, never absent or drifted.",
+					"type": "object",
+					"additionalProperties": {
+						"type": "object",
+						"required": ["reason", "until"],
+						"properties": {
+							"reason": {
+								"type": "string",
+								"description": "Why it settles. Known: stale, missing. A later version may add a reason."
+							},
+							"until": { "type": "string" }
+						},
+						"additionalProperties": true
+					}
+				},
 				"notCaptured": {
-					"description": "Documented response fields Kalup does not capture, per resource type.",
+					"description": "Documented response fields Kalup drops, by resource type. A later version may add a type.",
 					"type": "object",
 					"required": [
 						"property",
 						"group",
 						"object"
 					],
-					"properties": {
-						"property": {
-							"type": "array",
-							"items": { "type": "string" }
-						},
-						"group": {
-							"type": "array",
-							"items": { "type": "string" }
-						},
-						"object": {
-							"type": "array",
-							"items": { "type": "string" }
-						},
-						"pipeline": {
-							"type": "array",
-							"items": { "type": "string" }
-						},
-						"stage": {
-							"type": "array",
-							"items": { "type": "string" }
-						},
-						"association": {
-							"type": "array",
-							"items": { "type": "string" }
-						}
-					},
-					"additionalProperties": false
+					"additionalProperties": false,
+					"patternProperties": { "^[a-z]+$": {
+						"type": "array",
+						"items": { "type": "string" }
+					} }
 				}
 			},
-			"additionalProperties": false
+			"additionalProperties": true
 		},
 		"objectCoverage": {
 			"type": "object",
@@ -697,7 +665,7 @@ var ir_1_schema_default = {
 							"items": { "type": "string" }
 						}
 					},
-					"additionalProperties": false
+					"additionalProperties": true
 				},
 				"excluded": {
 					"description": "Addresses a skip override leaves out.",
@@ -718,7 +686,7 @@ var ir_1_schema_default = {
 						"status": { "enum": ["read", "unreadable"] },
 						"missingScope": { "type": "string" }
 					},
-					"additionalProperties": false
+					"additionalProperties": true
 				},
 				"associations": {
 					"description": "The associations of the pairs this object is in, pair by pair: per other object, whether the pair was read, and the user-defined types of this direction no name reached; and the HubSpot type IDs of each association addressed from this object. Absent when no pair with this object is in scope.",
@@ -737,10 +705,10 @@ var ir_1_schema_default = {
 							}
 						}
 					},
-					"additionalProperties": false
+					"additionalProperties": true
 				}
 			},
-			"additionalProperties": false
+			"additionalProperties": true
 		},
 		"unsupportedProperty": {
 			"description": "A present property Kalup does not write: no builder carries its type or fieldType, or HubSpot fills its options (owner or externalOptions). It is compared like any property but is not a resource.",
@@ -768,7 +736,7 @@ var ir_1_schema_default = {
 				"externalOptions": { "type": "boolean" },
 				"referencedObjectType": { "type": "string" }
 			},
-			"additionalProperties": false
+			"additionalProperties": true
 		},
 		"tombstone": {
 			"description": "Written by `kalup rm`. destroy archives or deletes in the portal; release stops managing and leaves it.",
@@ -801,7 +769,7 @@ var ir_1_schema_default = {
 					}
 				}
 			},
-			"additionalProperties": false
+			"additionalProperties": true
 		}
 	}
 };
@@ -825,6 +793,11 @@ function sortKeys(value) {
 	return Object.fromEntries(Object.keys(record).sort().map((key) => [key, sortKeys(record[key])]));
 }
 const IR_SCHEMA = ir_1_schema_default;
+/** The fields of a read's coverage and of an object's coverage this version knows: any other is a later version's. */
+const COVERAGE_FIELDS = {
+	coverage: new Set(Object.keys((IR_SCHEMA.$defs?.coverage)?.properties ?? {})),
+	object: new Set(Object.keys((IR_SCHEMA.$defs?.objectCoverage)?.properties ?? {}))
+};
 /** Checks a document against ir-1.schema.json. Empty when it conforms. */
 function validateIR(document) {
 	return validateSchema(IR_SCHEMA, document).map(({ path, message }) => ({
@@ -865,7 +838,11 @@ function validateSchema(root, document) {
 		const own = ownEntry(schema.properties, name);
 		const patterns = Object.entries(schema.patternProperties ?? {}).filter(([pattern]) => new RegExp(pattern, "u").test(name));
 		if (own) check(own, field, path, out);
-		for (const [, pattern] of patterns) check(pattern, field, path, out);
+		for (const [, pattern] of patterns) if (pattern === false) out.push({
+			path,
+			message: `unexpected field "${name}"`
+		});
+		else check(pattern, field, path, out);
 		if (own || patterns.length > 0) return;
 		if (schema.additionalProperties === false) out.push({
 			path,
@@ -943,11 +920,14 @@ function assertSupported(value, at, root = false) {
 		if (part !== void 0 && !(keyword === "additionalProperties" && typeof part === "boolean")) assertSupported(part, `${at}/${keyword}`);
 	}
 	for (const [index, part] of (schema.allOf ?? []).entries()) assertSupported(part, `${at}/allOf/${index}`);
+	assertNamed(schema, at);
+}
+function assertNamed(schema, at) {
 	for (const keyword of [
 		"$defs",
 		"properties",
 		"patternProperties"
-	]) for (const [name, part] of Object.entries(schema[keyword] ?? {})) assertSupported(part, `${at}/${keyword}/${name}`);
+	]) for (const [name, part] of Object.entries(schema[keyword] ?? {})) if (!(keyword === "patternProperties" && part === false)) assertSupported(part, `${at}/${keyword}/${name}`);
 }
 function ownEntry(record, key) {
 	return record && Object.hasOwn(record, key) ? record[key] : void 0;
@@ -2492,7 +2472,7 @@ function parseProperty(s, path, key, cs) {
 	};
 	if (kind === "json") {
 		expect(s, "punct", ",", "add the validator as the second argument", path);
-		prop.json = { validatorSource: opaque(s, path) };
+		prop.json = { validatorSource: opaque$1(s, path) };
 	}
 	if (skip(s, ",") && !is(peek(s), "punct", ")")) {
 		prop.definition = definition(s, path);
@@ -2525,7 +2505,7 @@ function chainCall(s, m, path) {
 	if (!is(next(s), "punct", ")")) bad(`.${flag}() takes ${managed ? "only false" : "no argument"}`, call);
 	return flag;
 }
-function opaque(s, path) {
+function opaque$1(s, path) {
 	const t = next(s);
 	if (t.kind !== "opaque" || !t.value) fail$1(s, "E_NOT_DATA", t, "p.json needs a validator", "write p.json(name, validator, {...})", path);
 	return t.value;
@@ -4493,7 +4473,7 @@ var state_1_schema_default = {
 	$schema: "https://json-schema.org/draft/2020-12/schema",
 	$id: "https://kalup.dev/schemas/state-1.schema.json",
 	title: "Kalup portal state, version 1",
-	description: ".kalup/state/portal-<portalId>.json. Describes one verified portal, not the code, and holds no target name. Covered by the compatibility policy (docs/compatibility.md): closed at every level apart from the free-form values in an entry's base and rewrites, so a new field is a new format version. No tokens, record data, unowned fields or unmanaged resources.",
+	description: ".kalup/state/portal-<portalId>.json. Describes one verified portal, not the code, and holds no target name. Covered by the compatibility policy (docs/compatibility.md). Open for additions within kalup.state/1: a later 1.x may add top-level fields, resource entries of types this version does not plan, and fields on an entry. A reader keeps what it does not know: it never drops an entry of a type it does not handle or a top-level field it does not know, and it drops an entry's unknown fields only when it rewrites that entry. lastApply, an entry's attested and rewrites, and the base's option members stay closed. Kalup never writes a key, record data, unowned fields or unmanaged resources: its state writer refuses a file holding anything shaped like a key.",
 	type: "object",
 	required: [
 		"format",
@@ -4554,20 +4534,16 @@ var state_1_schema_default = {
 			"additionalProperties": false
 		}
 	},
-	additionalProperties: false,
+	additionalProperties: true,
 	$defs: {
 		"resourceState": {
 			"type": "object",
 			"required": ["origin", "id"],
 			"properties": {
 				"origin": {
-					"description": "created and adopted are owned. pulled owns nothing: pull recorded the base of a resource no entry owned, and a plan still adopts it.",
-					"enum": [
-						"created",
-						"adopted",
-						"reference",
-						"pulled"
-					]
+					"description": "created and adopted are owned. pulled owns nothing: pull recorded the base of a resource no entry owned, and a plan still adopts it. reference owns nothing. Another value, from a later 1.x, owns nothing here.",
+					"type": "string",
+					"pattern": "^[a-z]+$"
 				},
 				"id": {
 					"description": "The portal name the entry owns. It owns the resource only while this equals the name the address resolves to. null for runbook-only types.",
@@ -4612,9 +4588,18 @@ var state_1_schema_default = {
 					"description": "An association's HubSpot type IDs in this portal, its direction's first: they name it while HubSpot's schema read does not list its name yet.",
 					"type": "array",
 					"items": { "type": "integer" }
+				},
+				"written": {
+					"description": "The units apply wrote within the settling window before its last write, each with when it verified the write. For a few minutes HubSpot may serve an older copy, so a read that disagrees on such a unit is settling: unknown, never drift.",
+					"type": "object",
+					"additionalProperties": { "type": "string" }
+				},
+				"writtenAt": {
+					"description": "When apply last verified a write to the resource, whatever units it named. A read that does not show the resource within the settling window after it is settling: unknown, never absence.",
+					"type": "string"
 				}
 			},
-			"additionalProperties": false
+			"additionalProperties": true
 		},
 		"base": {
 			"description": "Per owned unit, the value config and portal last agreed on; possibly partial. Scalar units by field name. options: a map keyed by option value whose members hold the agreed label, hidden and description; a member with no fields means only its membership is agreed. optionsOrder: the agreed order of the members both sides held.",
@@ -4660,118 +4645,6 @@ var KalupError = class extends Error {
 		this.exitCode = exitCode;
 	}
 };
-const ansi = /\u001b\[[0-?]*[ -/]*[@-~]/g;
-const control = /[\u0000-\u001f\u007f-\u009f\u2028\u2029\u202a-\u202e\u2066-\u2069]/g;
-/** Strips ANSI sequences, control and bidirectional formatting characters and newlines, and caps the length. */
-function sanitize(text, max = 120) {
-	const clean = text.replace(ansi, "").replace(control, "");
-	const chars = Array.from(clean);
-	return chars.length > max ? `${chars.slice(0, max - 1).join("")}…` : clean;
-}
-const STATE_SCHEMA = state_1_schema_default;
-/** Checks a document against state-1.schema.json. Empty when it conforms. */
-function validateState(document) {
-	return validateSchema(STATE_SCHEMA, document).map(({ path, message }) => ({
-		code: "E_STATE_SCHEMA",
-		message,
-		...path ? { configPath: path } : {}
-	}));
-}
-const FORMAT = "kalup.state/1";
-const notJson$3 = Symbol("not JSON");
-/**
-* The state of `portalId` from the text of `file`, where the host keeps it. E_STATE_INVALID when the text is not JSON,
-* names a format other than kalup.state/1, does not match its schema, or describes another portal. `target` names the
-* target in the fix.
-*/
-function parseState(text, file, portalId, target) {
-	const document = parseJson$3(text);
-	if (document === notJson$3) throw invalid$1(file, "is not JSON", target);
-	const format = document?.format;
-	if (typeof format === "string" && format !== FORMAT) throw new KalupError({
-		code: "E_STATE_INVALID",
-		message: `${file} is ${sanitize(format)}, and this version of ${bin} reads ${FORMAT}.`,
-		file,
-		fix: `use the version of ${bin} that wrote it, or a newer one`
-	});
-	const issues = validateState(document);
-	if (issues.length > 0) {
-		const [first] = issues;
-		const at = first?.configPath ? ` at ${first.configPath}` : "";
-		throw invalid$1(file, `does not match ${FORMAT}${at}: ${first?.message}`, target);
-	}
-	const state = document;
-	if (state.portalId !== portalId) throw invalid$1(file, `describes portal ${state.portalId}, not portal ${portalId}`, target);
-	return state;
-}
-function parseJson$3(text) {
-	try {
-		return JSON.parse(text);
-	} catch {
-		return notJson$3;
-	}
-}
-function invalid$1(file, why, target = "<target>") {
-	const name = file.slice(Math.max(file.lastIndexOf("/"), file.lastIndexOf("\\")) + 1);
-	return new KalupError({
-		code: "E_STATE_INVALID",
-		message: `${file} ${why}.`,
-		file,
-		fix: `rename ${name}.bak, the state before its last save, into its place if it reads; else move the file away and run ${bin} state rebuild --target ${target}`
-	});
-}
-/** An association address written from the other side: `association:<b>/<a>/<name>` for `association:<a>/<b>/<name>`. */
-function reversedAssociation(address) {
-	if (!address.startsWith("association:")) return;
-	const [from, to, ...name] = address.slice(12).split("/");
-	return `association:${to}/${from}/${name.join("/")}`;
-}
-/**
-* State with each association entry under the address `held` gives the association. An association's identity is its
-* name, and its direction is only how config writes it, so an entry at the reversed address moves to the held one, its
-* labels and type IDs swapped; one the held address has an entry of the same name for already is dropped. Every save
-* of the state so read keeps the move.
-*/
-function followAssociations(state, held) {
-	if (state === null) return state;
-	const resources = { ...state.resources };
-	let moved = false;
-	for (const [address, entry] of Object.entries(state.resources)) {
-		const reversed = reversedAssociation(address);
-		if (reversed === void 0 || held(address) || !held(reversed)) continue;
-		const there = Object.hasOwn(resources, reversed) ? resources[reversed] : void 0;
-		if (there !== void 0 && there.id !== entry.id) continue;
-		delete resources[address];
-		resources[reversed] = there ?? reversedEntry(entry);
-		moved = true;
-	}
-	return moved ? {
-		...state,
-		resources
-	} : state;
-}
-function reversedEntry(entry) {
-	const { base, rewrites, typeIds, ...rest } = entry;
-	const out = { ...rest };
-	if (base !== void 0) out.base = swapLabels(base);
-	if (rewrites !== void 0) out.rewrites = swapLabels(rewrites);
-	if (typeIds !== void 0) out.typeIds = [typeIds[1], typeIds[0]];
-	return out;
-}
-function swapLabels(units) {
-	const { label, inverseLabel, ...rest } = units;
-	return {
-		...rest,
-		...inverseLabel === void 0 ? {} : { label: inverseLabel },
-		...label === void 0 ? {} : { inverseLabel: label }
-	};
-}
-/** The type IDs state records per association address, which name a label HubSpot's schema read does not list yet. */
-function associationIds(state) {
-	const out = {};
-	for (const [address, entry] of Object.entries(state?.resources ?? {})) if (entry.typeIds !== void 0 && address.startsWith("association:")) out[address] = entry.typeIds;
-	return out;
-}
 const registry = {
 	property: {
 		family: "crm.properties",
@@ -5076,6 +4949,14 @@ const NORM_VERSIONS = {
 	association: 1
 };
 /**
+* Whether this version plans and applies resources of `type`: every such type has a normalizer version. A later 1.x
+* may add a type within the format versions; this version keeps such entries in state, reports them as not handled,
+* and refuses a plan step of one (docs/compatibility.md).
+*/
+function handledType(type) {
+	return Object.hasOwn(NORM_VERSIONS, type);
+}
+/**
 * Standard objects whose properties and groups read under a scope other than `crm.schemas.<object>.read`, checked
 * against HubSpot's scopes reference and the scope lists of the 2026-09 properties and property groups list paths.
 * Commerce payments drop the underscore. Products have no read scope on those lists but the legacy e-commerce, which
@@ -5114,51 +4995,218 @@ const standardName = /^[a-z_]+$/;
 function readScope(row, objectType = "") {
 	return scopeFor$1(row.scopes?.read[0], scopeExceptions, objectType);
 }
-function writeScope(row, objectType = "") {
-	return scopeFor$1(row.scopes?.write[0], writeScopeExceptions, objectType);
+function writeScope(row, objectType = "") {
+	return scopeFor$1(row.scopes?.write[0], writeScopeExceptions, objectType);
+}
+/**
+* The scope one request needs: its row's for the object its path names. A labels path names two objects, so it needs
+* both their scopes, named in code-unit order: plan and apply name the same whichever direction they read.
+*/
+function requestScope(type, params, mode) {
+	const row = Object.hasOwn(registry, type) ? registry[type] : void 0;
+	if (row === void 0) return;
+	const scope = (objectType) => mode === "read" ? readScope(row, objectType) : writeScope(row, objectType);
+	const { fromObjectType, toObjectType } = params ?? {};
+	if (fromObjectType !== void 0 && toObjectType !== void 0) {
+		const both = [scope(fromObjectType), scope(toObjectType)].filter((s) => s !== void 0);
+		return [...new Set(both)].sort().join(" and ");
+	}
+	return scope(params?.objectType);
+}
+const LIMIT_OBJECTS = /* @__PURE__ */ new Set([
+	"companies",
+	"contacts",
+	"deals"
+]);
+/**
+* The crm.objects read scope Kalup recommends so plan can read the property limit: on the first of `objects` that is
+* companies, contacts or deals, else on companies. HubSpot's Limits Tracking custom-properties answered 403 to a key
+* with crm.schemas scopes only, and 200 once crm.objects.companies.read was added, on a developer test account (runs
+* 89b45da9 and fb6155db, 2026-09-29).
+*/
+function limitScope(objects) {
+	return `crm.objects.${objects.find((o) => LIMIT_OBJECTS.has(o)) ?? "companies"}.read`;
+}
+function scopeFor$1(template, exceptions, objectType) {
+	if (!template?.includes("{object}")) return template;
+	const object = standardName.test(objectType) ? objectType : "custom";
+	if (Object.hasOwn(exceptions, object)) return exceptions[object];
+	return template.replace("{object}", object);
+}
+/** Fills every `{placeholder}` in a path template, for example `{objectType}` and `{name}`. */
+function fillPath(template, params) {
+	return template.replace(/\{(\w+)\}/g, (_, key) => {
+		const value = params[key];
+		if (value === void 0) throw new Error(`Path ${template} needs {${key}}`);
+		return encodeURIComponent(value);
+	});
+}
+const ansi = /\u001b\[[0-?]*[ -/]*[@-~]/g;
+const control = /[\u0000-\u001f\u007f-\u009f\u2028\u2029\u202a-\u202e\u2066-\u2069]/g;
+/** Strips ANSI sequences, control and bidirectional formatting characters and newlines, and caps the length. */
+function sanitize(text, max = 120) {
+	const clean = text.replace(ansi, "").replace(control, "");
+	const chars = Array.from(clean);
+	return chars.length > max ? `${chars.slice(0, max - 1).join("")}…` : clean;
+}
+const KEY_SHAPE = /pat-[a-z0-9]+-[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/i;
+/** Whether `value` holds one of `keys`, the keys the run holds, or anything shaped like a HubSpot key. */
+function holdsKey(value, keys = []) {
+	return KEY_SHAPE.test(value) || keys.some((key) => key !== "" && value.includes(key));
+}
+const STATE_SCHEMA = state_1_schema_default;
+const STATE_FIELDS = new Set(Object.keys(STATE_SCHEMA.properties ?? {}));
+const ENTRY_FIELDS = new Set(Object.keys((STATE_SCHEMA.$defs?.resourceState)?.properties ?? {}));
+/** An entry with only the fields this version knows: what a rewrite keeps of it. */
+function knownFields(entry) {
+	return Object.fromEntries(Object.entries(entry).filter(([field]) => ENTRY_FIELDS.has(field)));
+}
+/** Checks a document against state-1.schema.json. Empty when it conforms. */
+function validateState(document) {
+	return validateSchema(STATE_SCHEMA, document).map(({ path, message }) => ({
+		code: "E_STATE_SCHEMA",
+		message,
+		...path ? { configPath: path } : {}
+	}));
+}
+const FORMAT = "kalup.state/1";
+const notJson$3 = Symbol("not JSON");
+/**
+* The state of `portalId` from the text of `file`, where the host keeps it. E_STATE_INVALID when the text is not JSON,
+* names a format other than kalup.state/1, does not match its schema, or describes another portal. `target` names the
+* target in the fix.
+*/
+function parseState(text, file, portalId, target) {
+	const document = parseJson$3(text);
+	if (document === notJson$3) throw invalid$1(file, "is not JSON", target);
+	const format = document?.format;
+	if (typeof format === "string" && format !== FORMAT) throw new KalupError({
+		code: "E_STATE_INVALID",
+		message: `${file} is ${sanitize(format)}, and this version of ${bin} reads ${FORMAT}.`,
+		file,
+		fix: `use the version of ${bin} that wrote it, or a newer one`
+	});
+	const issues = validateState(document);
+	if (issues.length > 0) {
+		const [first] = issues;
+		const at = first?.configPath ? ` at ${first.configPath}` : "";
+		throw invalid$1(file, `does not match ${FORMAT}${at}: ${first?.message}`, target);
+	}
+	const state = document;
+	if (state.portalId !== portalId) throw invalid$1(file, `describes portal ${state.portalId}, not portal ${portalId}`, target);
+	return withLater(state);
+}
+function withLater(document) {
+	const fields = Object.fromEntries(Object.entries(document).filter(([key]) => !STATE_FIELDS.has(key)));
+	const entries = Object.entries(document.resources);
+	const resources = Object.fromEntries(entries.filter(([address]) => !handled(address)));
+	const state = {
+		...Object.fromEntries(Object.entries(document).filter(([key]) => STATE_FIELDS.has(key))),
+		resources: Object.fromEntries(entries.filter(([a]) => handled(a)))
+	};
+	if (Object.keys(fields).length + Object.keys(resources).length > 0) state.later = {
+		fields,
+		resources
+	};
+	return state;
+}
+function handled(address) {
+	return handledType(parseAddress(address).type);
 }
 /**
-* The scope one request needs: its row's for the object its path names. A labels path names two objects, so it needs
-* both their scopes, named in code-unit order: plan and apply name the same whichever direction they read.
+* The text a host writes for `state`: what a later version wrote merged back as it was, checked against kalup.state/1,
+* one JSON document and a newline. Throws, writing nothing, when the document does not match the schema or a string in
+* it, a key or a value, holds anything shaped like a HubSpot key.
 */
-function requestScope(type, params, mode) {
-	const row = Object.hasOwn(registry, type) ? registry[type] : void 0;
-	if (row === void 0) return;
-	const scope = (objectType) => mode === "read" ? readScope(row, objectType) : writeScope(row, objectType);
-	const { fromObjectType, toObjectType } = params ?? {};
-	if (fromObjectType !== void 0 && toObjectType !== void 0) {
-		const both = [scope(fromObjectType), scope(toObjectType)].filter((s) => s !== void 0);
-		return [...new Set(both)].sort().join(" and ");
+function stateText(state) {
+	const { later, ...known } = state;
+	const document = {
+		...later?.fields,
+		...known,
+		resources: {
+			...later?.resources,
+			...known.resources
+		}
+	};
+	const problems = validateState(document);
+	if (problems.length > 0) throw new Error(`refusing to save state that does not match kalup.state/1: ${problems[0]?.message}`);
+	if (strings(document).some((value) => holdsKey(value))) throw new Error("refusing to save state that holds a key");
+	return `${stableStringify(document)}\n`;
+}
+function strings(value) {
+	if (typeof value === "string") return [value];
+	if (Array.isArray(value)) return value.flatMap(strings);
+	if (typeof value === "object" && value !== null) return Object.entries(value).flatMap(([key, field]) => [key, ...strings(field)]);
+	return [];
+}
+function parseJson$3(text) {
+	try {
+		return JSON.parse(text);
+	} catch {
+		return notJson$3;
 	}
-	return scope(params?.objectType);
 }
-const LIMIT_OBJECTS = /* @__PURE__ */ new Set([
-	"companies",
-	"contacts",
-	"deals"
-]);
+function invalid$1(file, why, target = "<target>") {
+	const name = file.slice(Math.max(file.lastIndexOf("/"), file.lastIndexOf("\\")) + 1);
+	return new KalupError({
+		code: "E_STATE_INVALID",
+		message: `${file} ${why}.`,
+		file,
+		fix: `rename ${name}.bak, the state before its last save, into its place if it reads; else move the file away and run ${bin} state rebuild --target ${target}`
+	});
+}
+/** An association address written from the other side: `association:<b>/<a>/<name>` for `association:<a>/<b>/<name>`. */
+function reversedAssociation(address) {
+	if (!address.startsWith("association:")) return;
+	const [from, to, ...name] = address.slice(12).split("/");
+	return `association:${to}/${from}/${name.join("/")}`;
+}
 /**
-* The crm.objects read scope Kalup recommends so plan can read the property limit: on the first of `objects` that is
-* companies, contacts or deals, else on companies. HubSpot's Limits Tracking custom-properties answered 403 to a key
-* with crm.schemas scopes only, and 200 once crm.objects.companies.read was added, on a developer test account (runs
-* 89b45da9 and fb6155db, 2026-09-29).
+* State with each association entry under the address `held` gives the association. An association's identity is its
+* name, and its direction is only how config writes it, so an entry at the reversed address moves to the held one, its
+* labels and type IDs swapped; one the held address has an entry of the same name for already is dropped. Every save
+* of the state so read keeps the move.
 */
-function limitScope(objects) {
-	return `crm.objects.${objects.find((o) => LIMIT_OBJECTS.has(o)) ?? "companies"}.read`;
+function followAssociations(state, held) {
+	if (state === null) return state;
+	const resources = { ...state.resources };
+	let moved = false;
+	for (const [address, entry] of Object.entries(state.resources)) {
+		const reversed = reversedAssociation(address);
+		if (reversed === void 0 || held(address) || !held(reversed)) continue;
+		const there = Object.hasOwn(resources, reversed) ? resources[reversed] : void 0;
+		if (there !== void 0 && there.id !== entry.id) continue;
+		delete resources[address];
+		resources[reversed] = there ?? reversedEntry(entry);
+		moved = true;
+	}
+	return moved ? {
+		...state,
+		resources
+	} : state;
 }
-function scopeFor$1(template, exceptions, objectType) {
-	if (!template?.includes("{object}")) return template;
-	const object = standardName.test(objectType) ? objectType : "custom";
-	if (Object.hasOwn(exceptions, object)) return exceptions[object];
-	return template.replace("{object}", object);
+function reversedEntry(entry) {
+	const { base, rewrites, typeIds, written, ...rest } = entry;
+	const out = { ...rest };
+	if (base !== void 0) out.base = swapLabels(base);
+	if (rewrites !== void 0) out.rewrites = swapLabels(rewrites);
+	if (written !== void 0) out.written = swapLabels(written);
+	if (typeIds !== void 0) out.typeIds = [typeIds[1], typeIds[0]];
+	return out;
 }
-/** Fills every `{placeholder}` in a path template, for example `{objectType}` and `{name}`. */
-function fillPath(template, params) {
-	return template.replace(/\{(\w+)\}/g, (_, key) => {
-		const value = params[key];
-		if (value === void 0) throw new Error(`Path ${template} needs {${key}}`);
-		return encodeURIComponent(value);
-	});
+function swapLabels(units) {
+	const { label, inverseLabel, ...rest } = units;
+	return {
+		...rest,
+		...inverseLabel === void 0 ? {} : { label: inverseLabel },
+		...label === void 0 ? {} : { inverseLabel: label }
+	};
+}
+/** The type IDs state records per association address, which name a label HubSpot's schema read does not list yet. */
+function associationIds(state) {
+	const out = {};
+	for (const [address, entry] of Object.entries(state?.resources ?? {})) if (entry.typeIds !== void 0 && address.startsWith("association:")) out[address] = entry.typeIds;
+	return out;
 }
 const baseUrl = "https://api.hubapi.com";
 const rateHeaders$1 = {
@@ -7029,6 +7077,20 @@ function classify(base, desired, observed, rules) {
 	if (desired.options && observed.options && !ignored.has("options")) units.push(...options(desired.options, observed.options, base, rules));
 	return units.sort((a, b) => byCodeUnit(a.unit, b.unit));
 }
+/** A stored base as a Spec: its scalar units as fields, its members in the agreed order, then by value. */
+function specOfBase(base) {
+	const { options: members, optionsOrder, ...fields } = base;
+	if (members === void 0) return { fields };
+	const order = optionsOrder ?? [];
+	const rank = (value) => order.includes(value) ? order.indexOf(value) : order.length;
+	return {
+		fields,
+		options: Object.entries(members).sort(([a], [b]) => rank(a) - rank(b) || byCodeUnit(a, b)).map(([value, member]) => ({
+			value,
+			...member
+		}))
+	};
+}
 /**
 * The base after an apply: every owned unit of `approved`, only those `units` names when given, whose live value
 * equals the approved value takes that value; every other unit keeps its previous base value or stays absent, so a
@@ -7211,7 +7273,7 @@ const PLAN_SCHEMA = {
 	$schema: "https://json-schema.org/draft/2020-12/schema",
 	$id: "https://kalup.dev/schemas/plan-1.schema.json",
 	title: "Kalup plan, version 1",
-	description: "What `kalup plan` would do to one target, with the context an approval binds to. Closed at every level, so a saved plan carries nothing this schema does not name, and a new field is a new format version.",
+	description: "What `kalup plan` would do to one target, with the context an approval binds to. Closed at every level, apart from the free-form values in a step's desired and expect.values, so a saved plan carries nothing this schema does not name. A later 1.x may add fields, values and step types; an earlier 1.x refuses a plan that uses one, before any request (docs/compatibility.md).",
 	type: "object",
 	required: [
 		"format",
@@ -7846,7 +7908,8 @@ const PLAN_SCHEMA = {
 					"override",
 					"unsupported",
 					"not-owned",
-					"policy"
+					"policy",
+					"settling"
 				] },
 				"detail": { "type": "string" },
 				"blocks": {
@@ -8671,8 +8734,12 @@ function capturedSpec(resource) {
 	const definition = resource.definition ?? {};
 	if (resource.type !== "property") return observedSpec(CAPTURED[resource.type], definition);
 	const options = definition.options ?? [];
+	if (resource.managed && !buildable(definition.type, definition.fieldType)) return observedSpec(CAPTURED.unsupported, definition, options);
 	return observedSpec(resource.managed ? propertyCaptured(definition.type) : [], definition, options);
 }
+function buildable(type, fieldType) {
+	return Object.keys(HUBSPOT_TYPES).some((kind) => HUBSPOT_TYPES[kind] === type && FIELD_TYPES[kind].includes(fieldType));
+}
 /** The fields config owns on a resource that exists: those it states, less those ignoreChanges released on create. */
 function ownedFields(resource) {
 	const ignored = new Set(resource.lifecycle?.ignoreChanges);
@@ -8688,7 +8755,8 @@ function specOf(fields) {
 }
 function objectOf(address) {
 	const { type, path } = parseAddress(address);
-	return type === "object" ? path : path.slice(0, path.indexOf("/"));
+	const at = path.indexOf("/");
+	return type === "object" || at === -1 ? path : path.slice(0, at);
 }
 /** The path after the object: a stage's is `<pipeline>/<stage>`; see stageIdOf for its own ID. */
 function nameOf(address) {
@@ -8724,6 +8792,14 @@ function shownName(address) {
 	const { type } = parseAddress(address);
 	return type === "stage" || type === "association" ? ownId(address) : nameOf(address);
 }
+/**
+* The portal name an address resolves to on a target: its name override, else its own name. A stage's is its stage ID;
+* its pipeline's ID is the pipeline address's.
+*/
+function resolvedName(overrides, address) {
+	const override = Object.hasOwn(overrides, address) ? overrides[address] : void 0;
+	return (override?.skip === true ? void 0 : override?.name) ?? shownName(address);
+}
 /** The resource types HubSpot purges on delete, with no archive and no restore (observed 2026-10-01 and 2026-10-05). */
 const PURGED_TYPES = /* @__PURE__ */ new Set([
 	"pipeline",
@@ -8915,6 +8991,87 @@ function baseFor(entry, address, id) {
 	if (!Object.hasOwn(NORM_VERSIONS, kind) || (entry.normVersion ?? NORM_VERSIONS[kind]) !== NORM_VERSIONS[kind]) return;
 	return entry.base;
 }
+/** How long after a verified write a read that disagrees with it is not trusted: longer than every lag observed. */
+const SETTLE_MS = 3e5;
+/** The addresses the read cannot be trusted on yet, each with why and until when. Sorted. */
+function settlingOf(input) {
+	const entries = Object.entries(input.state?.resources ?? {});
+	const out = /* @__PURE__ */ new Map();
+	for (const [address, entry] of entries) {
+		const settling = settlingFor(input, address, entry);
+		if (settling !== void 0) out.set(address, settling);
+	}
+	const unlisted = new Map([...out].filter(([a, s]) => s.reason === "missing" && parseAddress(a).type === "object").map(([a, s]) => [objectOf(a), s]));
+	for (const [address, entry] of entries) {
+		const [parent] = objectsOf$1(address).flatMap((key) => unlisted.get(key) ?? []);
+		const unseen = UNSEEN.has(input.status(address));
+		if (parent !== void 0 && !out.has(address) && unseen && owns(input, address, entry)) out.set(address, {
+			reason: "missing",
+			until: parent.until
+		});
+	}
+	return Object.fromEntries([...out].sort(([a], [b]) => byCodeUnit(a, b)));
+}
+/**
+* The units an entry records apply wrote, each with when: `units` at `now`, and those of an earlier write whose window
+* is still open, since a read may still serve the copy from before them. Undefined when none is open.
+*/
+function writtenAfter(entry, units, now) {
+	const at = now.toISOString();
+	const kept = Object.entries(entry?.written ?? {}).filter(([, when]) => settlesUntil(when, now) !== void 0);
+	const written = new Map([...kept, ...units.map((unit) => [unit, at])]);
+	return written.size === 0 ? void 0 : Object.fromEntries([...written].sort(([a], [b]) => byCodeUnit(a, b)));
+}
+function settlingFor(input, address, entry) {
+	if (!owns(input, address, entry)) return;
+	const status = input.status(address);
+	if (status === "absent") {
+		const until = entry.writtenAt === void 0 ? void 0 : settlesUntil(entry.writtenAt, input.now);
+		return until === void 0 ? void 0 : {
+			reason: "missing",
+			until
+		};
+	}
+	const open = Object.entries(entry.written ?? {}).flatMap(([unit, at]) => {
+		const until = settlesUntil(at, input.now);
+		return until === void 0 ? [] : [[unit, until]];
+	});
+	if (open.length === 0) return;
+	const observed = Object.hasOwn(input.resources, address) ? input.resources[address] : void 0;
+	const base = observed && baseFor(entry, address, entry.id);
+	if (status !== "present" || !observed?.managed || base === void 0) return;
+	const until = new Map(open);
+	const moved = classify(base, specOfBase(base), capturedSpec(observed), { options: "additive" }).flatMap((u) => {
+		const end = u.class === "converged" ? void 0 : until.get(u.unit);
+		return end === void 0 ? [] : [end];
+	});
+	return moved.length === 0 ? void 0 : {
+		reason: "stale",
+		until: latest(moved)
+	};
+}
+const UNSEEN = /* @__PURE__ */ new Set([
+	"absent",
+	"not-observed",
+	"unreadable"
+]);
+function owns(input, address, entry) {
+	return (entry.origin === "created" || entry.origin === "adopted") && entry.id === resolvedName(input.overrides, address);
+}
+function objectsOf$1(address) {
+	const { type } = parseAddress(address);
+	if (type === "object") return [];
+	return type === "association" ? pairOf(address) : [objectOf(address)];
+}
+function settlesUntil(at, now) {
+	const written = Date.parse(at);
+	if (!Number.isFinite(written) || written > now.getTime() + 3e5) return;
+	const end = Math.min(written, now.getTime()) + SETTLE_MS;
+	return now.getTime() < end ? new Date(end).toISOString() : void 0;
+}
+function latest(times) {
+	return [...times].sort(byCodeUnit).at(-1);
+}
 /**
 * The fields the 2026-09 properties, groups and schemas lists document that no captured resource carries. `archived`
 * is not listed: an archived resource is not captured at all. `dateDisplayHint` is read-only in practice: HubSpot
@@ -8979,6 +9136,8 @@ const OBSERVED_TYPES = /* @__PURE__ */ new Set([
 /** The resource types read from an object's pipelines list. */
 const PIPELINE_TYPES = /* @__PURE__ */ new Set(["pipeline", "stage"]);
 const NAME_FIX = "rename it in HubSpot to a name without spaces";
+const SETTLING_SHOWN = 5;
+const TEXT_MAX$3 = 400;
 /**
 * The config IR as the side of a comparison, as target `target` sees it when one is given: its definition overrides
 * applied. It has no coverage: an address is present or absent.
@@ -8996,13 +9155,15 @@ function configObservation(loaded, target) {
 async function observeTarget(http, loaded, targetName, options = {}) {
 	const target = loaded.config.targets[targetName];
 	const issues = [];
-	return observePortal(await readPortal(http, loaded, target, issues, options), loaded, targetName, issues);
+	return observePortal(await readPortal(http, loaded, target, issues, options), loaded, targetName, issues, options.settle);
 }
 /**
 * What a read of target `targetName` holds for the config's objects, as observeTarget records it. pull records its own
 * read through here, so it classifies against the base exactly as plan does. Issues about the read go to `issues`.
+* With `settle`, a resource apply wrote minutes ago that the read shows otherwise is settling: unreadable, never
+* absent.
 */
-function observePortal(portal, loaded, targetName, issues) {
+function observePortal(portal, loaded, targetName, issues, settle) {
 	const target = loaded.config.targets[targetName];
 	const resources = [];
 	const meta = [];
@@ -9028,27 +9189,66 @@ function observePortal(portal, loaded, targetName, issues) {
 		});
 	}
 	const coverage = {
-		complete: Object.values(objects).every((o) => o.status !== "unreadable" && o.unaddressable === void 0 && o.pipelines?.status !== "unreadable" && Object.values(o.associations?.with ?? {}).every((p) => p.status !== "unreadable")),
+		complete: listsRead(objects) && Object.values(objects).every((o) => Object.values(o.associations?.with ?? {}).every((p) => !p.unnamed)),
 		objects,
 		otherObjects: portal.customObjects === void 0 ? "unknown" : [...portal.otherObjects].sort(byCodeUnit),
 		notCaptured: NOT_CAPTURED
 	};
-	return {
-		observation: {
-			side: {
-				kind: "target",
-				name: targetName,
-				portalId: target.portalId
-			},
-			resources: Object.fromEntries(resources.sort(([a], [b]) => byCodeUnit(a, b))),
-			coverage,
-			meta: Object.fromEntries(meta.sort(([a], [b]) => byCodeUnit(a, b))),
-			members,
-			listed
+	const observation = {
+		side: {
+			kind: "target",
+			name: targetName,
+			portalId: target.portalId
 		},
+		resources: Object.fromEntries(resources.sort(([a], [b]) => byCodeUnit(a, b))),
+		coverage,
+		meta: Object.fromEntries(meta.sort(([a], [b]) => byCodeUnit(a, b))),
+		members,
+		listed
+	};
+	issues.push(...unnamedIssues(objects));
+	if (settle) {
+		const followed = followAssociations(settle.state, (address) => Object.hasOwn(loaded.ir.resources, address));
+		settleCoverage(observation, coverage, target.overrides ?? {}, {
+			...settle,
+			state: followed
+		}, issues);
+	}
+	return {
+		observation,
 		issues
 	};
 }
+function unnamedIssues(objects) {
+	const both = Object.entries(objects).flatMap(([key, o]) => Object.entries(o.associations?.with ?? {}).flatMap(([other, p]) => p.unnamed ? [[key, other].sort(byCodeUnit).join(" and ")] : []));
+	const pairs = [...new Set(both)].sort(byCodeUnit);
+	if (pairs.length === 0) return [];
+	return [{
+		code: "W_SETTLING",
+		message: sanitize(`HubSpot lists association types between ${pairs.join(", ")} that its schema read does not name yet, so this read is not trusted on the associations there`, TEXT_MAX$3),
+		fix: "run the command again in a few minutes: HubSpot names a new association in its schema read some minutes after it is made"
+	}];
+}
+function settleCoverage(observation, coverage, overrides, settle, issues) {
+	const settling = settlingOf({
+		...settle,
+		overrides,
+		resources: observation.resources,
+		status: (address) => statusOf(observation, address)
+	});
+	const addresses = Object.keys(settling);
+	if (addresses.length === 0) return;
+	coverage.settling = settling;
+	coverage.complete = false;
+	const until = addresses.map((a) => settling[a].until).sort(byCodeUnit)[addresses.length - 1];
+	const shown = sanitize(addresses.slice(0, SETTLING_SHOWN).join(", "), TEXT_MAX$3);
+	const more = addresses.length > SETTLING_SHOWN ? ` and ${addresses.length - SETTLING_SHOWN} more` : "";
+	issues.push({
+		code: "W_SETTLING",
+		message: `HubSpot still serves an older copy of ${plural(addresses.length, "resource")} apply wrote minutes ago, so this read is not trusted on ${addresses.length === 1 ? "it" : "them"} until ${until}: ${shown}${more}`,
+		fix: `run the command again after ${until}`
+	});
+}
 /**
 * Whether an observation holds an address. Config: present or absent. A target or snapshot: the object's status
 * first, then a skip override, then the resource itself, then an unsupported property, then one config names that its
@@ -9056,9 +9256,18 @@ function observePortal(portal, loaded, targetName, issues) {
 * so it is never out of scope.
 */
 function statusOf(observation, address) {
+	const status = readStatus(observation, address);
+	return status === "absent" && observation.opaque ? "unreadable" : status;
+}
+/** Whether `address` is unknown only because a later version's incomplete read may have missed it (opaque). */
+function opaqueGap(observation, address) {
+	return observation.opaque === true && readStatus(observation, address) === "absent";
+}
+function readStatus(observation, address) {
 	const { coverage, resources } = observation;
 	const held = Object.hasOwn(resources, address);
 	if (!coverage) return held ? "present" : "absent";
+	if (settlingAt(coverage, address) !== void 0) return "unreadable";
 	const { type } = parseAddress(address);
 	if (type === "association") return associationStatus(coverage, address, held);
 	const key = objectOf(address);
@@ -9104,6 +9313,46 @@ function associationStatus(coverage, address, held) {
 	if (held) return "present";
 	return unnamedOf(coverage, from, to).length > 0 ? "unreadable" : "absent";
 }
+/** Why and until when the read cannot be trusted on an address yet, or undefined when it can. */
+function settlingAt(coverage, address) {
+	const settling = coverage.settling ?? {};
+	return Object.hasOwn(settling, address) ? settling[address] : void 0;
+}
+/**
+* Whether a read covered every list it needed and captured every property config names: the read is complete but for
+* what waits on HubSpot (waitingOn). Takeover, state rebuild and target rebind refuse a read that is not.
+*/
+function listsRead(objects) {
+	return Object.values(objects).every((o) => o.status !== "unreadable" && o.unaddressable === void 0 && o.pipelines?.status !== "unreadable" && Object.values(o.associations?.with ?? {}).every((p) => p.status !== "unreadable"));
+}
+/**
+* What the read leaves unknown among `addresses` only for the minutes HubSpot takes to settle: those settling after an
+* apply, and the associations a type HubSpot's schema read does not name yet may be. A command acting on these
+* addresses alone waits on this, never on what the read leaves unknown elsewhere.
+*/
+function waitingOn(observation, addresses) {
+	const { coverage } = observation;
+	const settling = [];
+	const unnamed = /* @__PURE__ */ new Set();
+	if (coverage === void 0) return {
+		settling,
+		unnamed: []
+	};
+	for (const address of [...new Set(addresses)].sort(byCodeUnit)) {
+		const settles = settlingAt(coverage, address);
+		if (settles !== void 0) {
+			settling.push([address, settles]);
+			continue;
+		}
+		const [from, to] = parseAddress(address).type === "association" ? pairOf(address) : [];
+		const unknown = statusOf(observation, address) === "unreadable";
+		if (from !== void 0 && to !== void 0 && unknown && unnamedOf(coverage, from, to).length > 0) unnamed.add([from, to].sort(byCodeUnit).join(" and "));
+	}
+	return {
+		settling,
+		unnamed: [...unnamed].sort(byCodeUnit)
+	};
+}
 /** One object's coverage of its pair with `other`, or undefined when that pair was not in scope. */
 function pairRead(object, other) {
 	const pairs = object?.associations?.with;
@@ -10134,6 +10383,8 @@ function stepFor(context, address, resource, status) {
 	}, context.policy, void 0);
 }
 function unread$1(context, address, status) {
+	const settling = settlingAt(context.coverage, address);
+	if (settling !== void 0) return settlingStep(address, settling);
 	const key = objectOf(address);
 	const object = own$2(context.coverage.objects, key);
 	const kind = kindOf$3(address);
@@ -10155,6 +10406,9 @@ function unread$1(context, address, status) {
 	const fix = scope === void 0 ? "check the scopes of the key" : `add the scope ${scope} to the key`;
 	return blocked(address, "unknown", "scope", `the key cannot read ${key}`, detail, fix);
 }
+function settlingStep(address, settling) {
+	return blocked(address, "unknown", "settling", "HubSpot is still settling", settling.reason === "missing" ? "apply created it minutes ago, and HubSpot does not list it yet" : "apply wrote it minutes ago, and HubSpot still serves an older copy of it", `plan again after ${settling.until}`);
+}
 function blockedParents(context, address, resource) {
 	if (kindOf$3(address) === "object") return [];
 	const group = (resource.definition?.group)?.$ref;
@@ -10168,7 +10422,8 @@ function blockedParents(context, address, resource) {
 	].flatMap((parent) => {
 		const found = parent === void 0 ? void 0 : context.decided.get(parent);
 		const update = found?.action === "update" && kindOf$3(found.address) === "object";
-		return found?.risk === "blocked" && !update ? [found] : [];
+		const stale = found !== void 0 && settlingAt(context.coverage, found.address)?.reason === "stale";
+		return found?.risk === "blocked" && !update && !stale ? [found] : [];
 	});
 }
 function missingGroup(context, resource) {
@@ -10299,7 +10554,9 @@ function unheldSteps(context) {
 		const holds = (property) => {
 			const address = `property:${key}/${property}`;
 			const decided = context.decided.get(address);
-			return decided?.action === "create" && decided.risk !== "blocked" || statusOf(observation, address) === "present" || outOfScope.includes(property);
+			const creates = decided?.action === "create" && decided.risk !== "blocked";
+			const stale = settlingAt(context.coverage, address)?.reason === "stale";
+			return creates || stale || statusOf(observation, address) === "present" || outOfScope.includes(property);
 		};
 		const fields = schemaWrites(step);
 		for (const field of OBJECT_DISPLAY_FIELDS) {
@@ -10895,6 +11152,24 @@ function uncovered(address, tombstone, cover) {
 	const fix = `set the action of ${cover} to release to keep it with what it holds, or this one's to destroy`;
 	return blocked(address, "release", "unsupported", `${kindOf$3(cover)} deleted`, detail, fix);
 }
+function takeoverWait(context, key) {
+	const { coverage } = context;
+	if (!listsRead(coverage.objects)) return {
+		reason: "scope",
+		short: "read incomplete",
+		why: `the read of target ${context.input.target} was incomplete`,
+		fix: INCOMPLETE_FIX
+	};
+	const until = Object.entries(coverage.settling ?? {}).filter(([address]) => objectOf(address) === key && TAKEOVER_KINDS.has(kindOf$3(address))).map(([, settling]) => settling.until).sort(byCodeUnit).at(-1);
+	if (until === void 0) return;
+	return {
+		reason: "settling",
+		short: "HubSpot is still settling",
+		why: `what apply wrote on ${key} minutes ago has not settled in HubSpot yet`,
+		fix: `plan again after ${until}`
+	};
+}
+const TAKEOVER_KINDS = /* @__PURE__ */ new Set(["property", "group"]);
 function takeoverOf$1(context, kind) {
 	if (kind === "property") return context.takeover.properties;
 	return kind === "group" ? context.takeover.groups : [];
@@ -10922,7 +11197,11 @@ function takeoverDelete(context, address, deleted) {
 		...refused,
 		...notes
 	});
-	if (!context.coverage.complete) return noted(blocked(address, "delete", "scope", "read incomplete", `takeover would archive ${name}, and the read of target ${target} was incomplete, so takeover removes nothing there`, INCOMPLETE_FIX));
+	const wait = takeoverWait(context, key);
+	if (wait) {
+		const detail = `takeover would archive ${name}, and ${wait.why}, so takeover removes nothing there`;
+		return noted(blocked(address, "delete", wait.reason, wait.short, detail, wait.fix));
+	}
 	const members = kindOf$3(address) === "group" ? {
 		active: own$2(observation.members?.[key] ?? {}, name) ?? [],
 		deleted: deleted.get(key) ?? /* @__PURE__ */ new Set()
@@ -10968,10 +11247,14 @@ function optionList(units) {
 function takeoverBlock(context, address, action, units) {
 	const { target } = context.input;
 	const notes = { notes: [optionsNote(context, address, units)] };
-	if (!context.coverage.complete) return {
-		...blocked(address, action, "scope", "read incomplete", `takeover would remove ${optionList(units)}, and the read of target ${target} was incomplete, so takeover removes nothing there`, INCOMPLETE_FIX),
-		...notes
-	};
+	const wait = takeoverWait(context, objectOf(address));
+	if (wait) {
+		const detail = `takeover would remove ${optionList(units)}, and ${wait.why}, so takeover removes nothing there`;
+		return {
+			...blocked(address, action, wait.reason, wait.short, detail, wait.fix),
+			...notes
+		};
+	}
 	if (!context.policy.allowDestroy) return {
 		...blocked(address, action, "policy", "option removals not allowed", `takeover removes ${optionList(units)}, which only the portal holds, and target ${target} does not allow deletes`, `keep them in config: run ${pullCommand(target, address)}; or keep them unmanaged: set lifecycle: { options: 'additive' } on ${nameOf(address)}; or remove them: set allowDestroy: true under targets.${target} in kalup.config.ts`),
 		...notes
@@ -11053,7 +11336,7 @@ function unreadAssociation(context, address) {
 	}
 	if (pair.status === "unreadable") return blocked(address, "unknown", "scope", "labels list refused", `HubSpot refused the labels list of ${from} and ${to} (${pair.issue ?? "E_HTTP"}), so what it holds there is unknown`, "check that HubSpot keeps associations between these two objects, then plan again");
 	const unnamed = unnamedOf(context.coverage, from, to).length;
-	return blocked(address, "unknown", "scope", "types not named yet", `HubSpot lists ${plural(unnamed, "association type")} between ${from} and ${to} that its schema read does not name yet, and this association may be one of them`, "plan again in a few minutes: HubSpot names a new association in its schema read some minutes after it is made");
+	return blocked(address, "unknown", "settling", "types not named yet", `HubSpot lists ${plural(unnamed, "association type")} between ${from} and ${to} that its schema read does not name yet, and this association may be one of them`, "plan again in a few minutes: HubSpot names a new association in its schema read some minutes after it is made");
 }
 function objectTakes(context, key) {
 	const { observation } = context.input;
@@ -11115,7 +11398,13 @@ function release(address, title, expect) {
 function orphansOf(input, steps) {
 	const { loaded, state, target } = input;
 	const overrides = loaded.config.targets[target]?.overrides ?? {};
-	return Object.entries(state?.resources ?? {}).filter(([address, entry]) => (entry.origin === "created" || entry.origin === "adopted") && !Object.hasOwn(loaded.ir.resources, address) && !Object.hasOwn(loaded.ir.tombstones, address) && coverOf(loaded.ir.tombstones, address) === void 0 && !heldReversed(loaded.ir, address) && !steps.some((s) => s.address === address)).sort(([a], [b]) => byCodeUnit(a, b)).map(([address, entry]) => {
+	const later = Object.keys(state?.later?.resources ?? {}).map((address) => {
+		return {
+			address,
+			note: sanitize(`a later version of ${bin} manages ${parseAddress(address).type} resources: this version leaves the entry as it is`, TEXT_MAX$2)
+		};
+	});
+	return [...Object.entries(state?.resources ?? {}).filter(([address, entry]) => (entry.origin === "created" || entry.origin === "adopted") && !Object.hasOwn(loaded.ir.resources, address) && !Object.hasOwn(loaded.ir.tombstones, address) && coverOf(loaded.ir.tombstones, address) === void 0 && !heldReversed(loaded.ir, address) && !steps.some((s) => s.address === address)).sort(([a], [b]) => byCodeUnit(a, b)).map(([address, entry]) => {
 		const name = resolvedName(overrides, address);
 		const rm = `${bin} rm ${shellWord(address)}`;
 		let note = `no longer in config: run ${rm} to delete it in HubSpot, or ${rm} --release to stop managing it`;
@@ -11127,7 +11416,7 @@ function orphansOf(input, steps) {
 			address,
 			note: sanitize(note, TEXT_MAX$2)
 		};
-	});
+	}), ...later].sort((a, b) => byCodeUnit(a.address, b.address));
 }
 function heldReversed(ir, address) {
 	const reversed = reversedAssociation(address);
@@ -11149,14 +11438,6 @@ function staleNote(context, address, stale) {
 function portalName$1(context, address) {
 	return resolvedName(context.overrides, address);
 }
-/**
-* The portal name an address resolves to on a target: its name override, else its own name. A stage's is its stage ID;
-* its pipeline's ID is the pipeline address's.
-*/
-function resolvedName(overrides, address) {
-	const override = own$2(overrides, address);
-	return (override?.skip === true ? void 0 : override?.name) ?? shownName(address);
-}
 function archivedOf(lists, key, name) {
 	const list = own$2(lists, key);
 	return list === void 0 ? null : list.find((p) => p.name === name);
@@ -11961,9 +12242,15 @@ function fromSnapshot$1(text, file) {
 			observedAt
 		},
 		resources: sorted(resources),
-		coverage
+		coverage,
+		...opaque(coverage) ? { opaque: true } : {}
 	};
 }
+function opaque(coverage) {
+	const unknown = (fields, known) => Object.keys(fields).some((f) => !known.has(f));
+	const later = unknown(coverage, COVERAGE_FIELDS.coverage) || Object.values(coverage.objects).some((object) => unknown(object, COVERAGE_FIELDS.object));
+	return !coverage.complete && later;
+}
 const PLAIN = /^[a-z0-9][a-z0-9_-]{0,63}$/;
 const DEVICE = /^(con|prn|aux|nul|com[1-9]|lpt[1-9])$/;
 const UNSAFE = /[^a-z0-9_-]/gu;
@@ -11983,7 +12270,8 @@ function planPath(targetName, planId) {
 }
 /**
 * W_INCOMPLETE for a read that left objects unread, or config properties uncaptured because their portal group's name
-* no address can hold, since what they hold is unknown. None for a complete read.
+* no address can hold, or that is not trusted yet on what settles after an apply or on a pair whose labels hold a type
+* HubSpot does not name yet, since what they hold is unknown. None for a complete read.
 */
 function incompleteIssues(coverage, target) {
 	if (coverage.complete) return [];
@@ -11992,13 +12280,19 @@ function incompleteIssues(coverage, target) {
 	const names = unread.map(([key]) => sanitize(key));
 	const properties = objects.flatMap(([key, o]) => [...o.unaddressable ?? []].sort(byCodeUnit).map((name) => sanitize(`property:${key}/${name}`)));
 	const scopes = [...new Set(unread.flatMap(([, o]) => o.missingScope === void 0 ? [] : [o.missingScope]))].sort(byCodeUnit).map((scope) => sanitize(scope));
-	const parts = [...names.length > 0 ? [`${listed(names)} ${names.length === 1 ? "was" : "were"} not read`] : [], ...properties.length > 0 ? [`${listed(properties)} ${properties.length === 1 ? "is" : "are"} in a portal group whose name no address can hold`] : []];
-	const one = names.length + properties.length === 1;
+	const lists = objects.some(([, o]) => o.pipelines?.status === "unreadable" || Object.values(o.associations?.with ?? {}).some((p) => p.status === "unreadable"));
+	const waiting = waitOf(coverage, objects);
+	const parts = [
+		...names.length > 0 ? [`${listed(names)} ${names.length === 1 ? "was" : "were"} not read`] : [],
+		...properties.length > 0 ? [`${listed(properties)} ${properties.length === 1 ? "is" : "are"} in a portal group whose name no address can hold`] : [],
+		...waiting.parts
+	];
+	const one = names.length + properties.length + waiting.count === 1;
 	const which = parts.length > 0 ? `: ${parts.join(", and ")}, so what ${one ? "it holds" : "they hold"} is unknown` : "";
 	const noun = scopes.length === 1 ? "the scope" : "the scopes";
 	const fixes = [];
 	if (scopes.length > 0) fixes.push(`add ${noun} ${listed(scopes)} to the read key of target ${sanitize(target)}`);
-	else if (names.length > 0 || properties.length === 0) fixes.push(`add the missing read scopes to the read key of target ${sanitize(target)}`);
+	else if (names.length > 0 || lists || parts.length === 0) fixes.push(`add the missing read scopes to the read key of target ${sanitize(target)}`);
 	if (properties.length > 0) {
 		const many = properties.length > 1;
 		fixes.push(`rename the group${many ? "s" : ""} of ${listed(properties)} in HubSpot to ${many ? "names" : "a name"} without spaces`);
@@ -12006,9 +12300,25 @@ function incompleteIssues(coverage, target) {
 	return [{
 		code: "W_INCOMPLETE",
 		message: `the snapshot of target ${sanitize(target)} is incomplete${which}`,
-		fix: `${fixes.join(" and ")}, then take a new snapshot`
+		fix: fixes.length > 0 ? `${fixes.join(" and ")}, then take a new snapshot${waiting.later}` : `take a new snapshot${waiting.later}`
 	}];
 }
+function waitOf(coverage, objects) {
+	const settling = Object.keys(coverage.settling ?? {}).sort(byCodeUnit).map((address) => sanitize(address));
+	const until = Object.values(coverage.settling ?? {}).map((s) => s.until).sort(byCodeUnit).at(-1);
+	const pairs = [...new Set(objects.flatMap(([key, o]) => Object.entries(o.associations?.with ?? {}).flatMap(([other, p]) => p.unnamed ? [[key, other].sort(byCodeUnit).join(" and ")] : [])))].sort(byCodeUnit).map((pair) => sanitize(pair));
+	const parts = [];
+	if (settling.length > 0) parts.push(`${listed(settling)} ${settling.length === 1 ? "is" : "are"} settling after an apply until ${until}`);
+	if (pairs.length > 0) parts.push(`the associations between ${listed(pairs)} hold a type HubSpot's schema read does not name yet`);
+	let later = "";
+	if (until !== void 0) later = ` after ${until}`;
+	else if (pairs.length > 0) later = " in a few minutes, once HubSpot names the new association";
+	return {
+		count: settling.length + 2 * pairs.length,
+		later,
+		parts
+	};
+}
 function targetDir(name) {
 	if (PLAIN.test(name) && !DEVICE.test(name)) return name;
 	return `${name.toLowerCase().replace(UNSAFE, "_").replace(EDGES, "").slice(0, 40).replace(EDGES, "") || "target"}-${createHash("sha256").update(name).digest("hex").slice(0, 8)}`;
@@ -12066,6 +12376,7 @@ function parsePlan(text, file, running) {
 		message: `${shown} ${other}. Nothing was sent.`,
 		fix: `plan again with this version: run ${bin} plan --target <name> --out <file>, review it and apply that file`
 	});
+	laterStep(document, shown);
 	const problems = validatePlan(document);
 	if (problems.length > 0) {
 		const [first] = problems;
@@ -12223,7 +12534,7 @@ function checkVersions(plan, now) {
 function normalizerProblems(plan) {
 	const known = NORM_VERSIONS;
 	const problems = [];
-	for (const kind of [.../* @__PURE__ */ new Set([...Object.keys(known), ...Object.keys(plan.normVersions)])].sort()) {
+	for (const kind of [...new Set(plan.steps.map((s) => parseAddress(s.address).type))].sort()) {
 		const planned = Object.hasOwn(plan.normVersions, kind) ? plan.normVersions[kind] : void 0;
 		const current = Object.hasOwn(known, kind) ? known[kind] : void 0;
 		if (planned !== current) problems.push(`the plan compared ${sanitize(kind)} under normalizer ${planned ?? "none"}, this version uses ${current ?? "none"}`);
@@ -12728,6 +13039,20 @@ function carriedDisagreement(step) {
 function sameValue(a, b) {
 	return b !== void 0 && stableStringify(a) === stableStringify(b);
 }
+function laterStep(document, shown) {
+	const steps = document?.steps;
+	for (const step of Array.isArray(steps) ? steps : []) {
+		const address = typeof step?.address === "string" ? step.address : "";
+		if (!isAddress(address) || handledType(parseAddress(address).type)) continue;
+		const { generator } = document;
+		const made = typeof generator?.version === "string" ? ` (${bin} ${sanitize(generator.version, 40)})` : "";
+		throw new KalupError({
+			code: "E_PLAN_INVALID",
+			message: `${shown}: step ${typeof step.id === "string" ? sanitize(step.id, 20) : "a step"} is a ${sanitize(parseAddress(address).type, 40)} step, which this version of ${bin} does not apply: a later version made the plan${made}. Nothing was sent.`,
+			fix: "apply the plan with the version that made it, or a later one"
+		});
+	}
+}
 function invalid(message) {
 	return new KalupError({
 		code: "E_PLAN_INVALID",
@@ -13201,13 +13526,21 @@ function verified(run, step, seen) {
 	if (step.action === "create") run.created.add(step.address);
 	const typeId = seen.raw?.objectTypeId;
 	if (createsObject(step) && typeof typeId === "string" && !run.typeIds.has(objectOf(step.address))) run.typeIds.set(objectOf(step.address), typeId);
-	const { rewrites: before, ...entry } = entryOf$1(run, step, verifiedBase(run, step, readBack));
-	const rewrites = rewritesAfter(before, writtenUnits(step, readBack), own);
-	const saved = rewrites === void 0 ? entry : {
+	const { rewrites: before, written: _, writtenAt: earlier, ...entry } = entryOf$1(run, step, verifiedBase(run, step, readBack));
+	const written = writtenUnits(step, readBack);
+	const rewrites = rewritesAfter(before, written, own);
+	const unsent = new Set(own.map((u) => u.unit));
+	const prior = Object.hasOwn(run.state.resources, step.address) ? run.state.resources[step.address] : void 0;
+	const now = run.deps.now();
+	const times = writtenAfter(prior, written.filter((unit) => !unsent.has(unit)), now);
+	const at = step.action === "create" || written.length > 0 ? now.toISOString() : earlier ?? prior?.writtenAt;
+	const saved = {
 		...entry,
-		rewrites
+		...rewrites === void 0 ? {} : { rewrites },
+		...times === void 0 ? {} : { written: times },
+		...at === void 0 ? {} : { writtenAt: at }
 	};
-	const also = carriedEntries(step, seen);
+	const also = carriedEntries(step, seen, now);
 	if (bad.length === 0) return {
 		report: report$1(step, "done"),
 		entry: saved,
@@ -13230,19 +13563,22 @@ function verified(run, step, seen) {
 		issues: [issue]
 	};
 }
-function carriedEntries(step, seen) {
+function carriedEntries(step, seen, now) {
 	return (step.stages ?? []).flatMap((st) => {
 		const live = seen.stages?.[st.address];
 		if (live === void 0) return [];
 		const units = classify(void 0, specOf(st.desired), capturedSpec(live), { options: "additive" });
 		const base = advanceBase(void 0, specOf(st.desired), capturedSpec(live));
 		const rewrites = rewritesAfter(void 0, units.map((u) => u.unit), units.filter((u) => u.class !== "converged"));
+		const sent = units.filter((u) => u.class === "converged").map((u) => u.unit);
 		const entry = {
 			origin: "created",
 			id: ownId(st.address),
 			normVersion: NORM_VERSIONS.stage,
 			...base === void 0 ? {} : { base },
-			...rewrites === void 0 ? {} : { rewrites }
+			...rewrites === void 0 ? {} : { rewrites },
+			...sent.length === 0 ? {} : { written: writtenAfter(void 0, sent, now) },
+			writtenAt: now.toISOString()
 		};
 		return [[st.address, entry]];
 	});
@@ -13296,10 +13632,18 @@ function unsettled(run, step, acknowledged) {
 		report: outcome,
 		issues: [issue]
 	};
+	const desired = specOf(step.desired ?? {});
+	const sent = classify(void 0, desired, desired, { options: "additive" }).map((u) => u.unit);
+	const now = run.deps.now();
+	const entry = {
+		...entryOf$1(run, step, void 0),
+		...sent.length === 0 ? {} : { written: writtenAfter(void 0, sent, now) },
+		writtenAt: now.toISOString()
+	};
 	return {
 		report: outcome,
 		issues: [issue],
-		entry: entryOf$1(run, step, void 0)
+		entry
 	};
 }
 function uncertain(run, step, why) {
@@ -13945,7 +14289,7 @@ function entryOf$1(run, step, base) {
 		const made = kind === "group" && madeByRun(run, step);
 		origin = owning?.origin ?? (made ? "adopted" : "created");
 	} else if (step.action === "update") origin = owning?.origin ?? "adopted";
-	const { base: _, ...kept } = step.action === "update" && owning ? owning : {};
+	const { base: _, ...kept } = step.action === "update" && owning ? knownFields(owning) : {};
 	const entry = {
 		...kept,
 		origin,
@@ -14460,6 +14804,18 @@ function comparedSet(a, b) {
 	return [...set].sort(byCodeUnit);
 }
 function compareAddress(address, a, b, options) {
+	const { type } = parseAddress(address);
+	if (!handledType(type)) {
+		if (!(a.coverage && b.coverage)) return {
+			address,
+			status: "unmanaged"
+		};
+		return {
+			address,
+			status: "unknown",
+			reason: sanitize(`a later version of ${bin} handles ${type} resources; this version does not compare them`)
+		};
+	}
 	const statusA = statusOf(a, address);
 	const statusB = statusOf(b, address);
 	const unknown = [unknownReason(a, address, statusA, options.overridden?.a), unknownReason(b, address, statusB, options.overridden?.b)].filter((r) => r !== void 0);
@@ -14606,15 +14962,31 @@ function optionDefaults(spec) {
 function unknownReason(side, address, status, overridden) {
 	const name = describeShort(side.side);
 	if (status !== "excluded" && overridden?.includes(address)) return `${name} has a lookup override for it; this version manages no lookup resources`;
+	if (opaqueGap(side, address)) return `${name} was taken by a later version of ${bin}, whose read was incomplete in parts this version cannot place`;
 	const key = objectOf(address);
+	const settling = settlingOn(side, address);
+	if (settling !== void 0) return `${name} is settling after an apply until ${settling.until}`;
 	if (status === "unreadable") {
 		const object = coverageOf(side, key);
-		if (object?.status === "read") return `${name} could not capture it: its group's name in the portal holds whitespace`;
+		if (object?.status === "read") return readObjectReason(side, address, name);
 		const scope = object?.missingScope;
 		return `${name} could not read ${key}${scope === void 0 ? "" : `: the key lacks ${scope}`}`;
 	}
 	return status === "not-observed" ? `${name} did not read ${key}` : void 0;
 }
+function readObjectReason(side, address, name) {
+	const { type } = parseAddress(address);
+	if (type === "association") {
+		const pair = pairOf(address).sort(byCodeUnit);
+		return unnamedOn(side, address) ? `${name} lists a type between ${pair.join(" and ")} that HubSpot's schema read does not name yet` : `${name} could not read the labels between ${pair.join(" and ")}`;
+	}
+	if (type === "pipeline" || type === "stage") return `${name} could not read the pipelines of ${objectOf(address)}`;
+	return `${name} could not capture it: its group's name in the portal holds whitespace`;
+}
+function unnamedOn(side, address) {
+	const [from, to] = pairOf(address);
+	return statusOf(side, address) === "unreadable" && settlingOn(side, address) === void 0 && side.coverage !== void 0 && unnamedOf(side.coverage, from, to).length > 0;
+}
 function excludedReason(side, address, status) {
 	if (status !== "excluded") return;
 	const name = describeShort(side.side);
@@ -14665,6 +15037,10 @@ function incomplete(comparison, a, b) {
 		const many = regroup.length > 1;
 		fixes.push(`rename the group${many ? "s" : ""} of ${regroup.join(", ")} in HubSpot to ${many ? "names" : "a name"} without spaces, then read the portal again`);
 	}
+	fixes.push(...[a, b].flatMap((side) => waitFix(side, comparison)));
+	const later = [...new Set(comparison.differences.map((d) => parseAddress(d.address).type).filter((type) => !handledType(type)))].sort(byCodeUnit);
+	if (later.length > 0) fixes.push(`compare with a later version of ${bin}, which handles ${later.map((t) => `${t} resources`).join(", ")}`);
+	else if (a.opaque || b.opaque) fixes.push(`compare with the later version of ${bin} that took the snapshot`);
 	const issue = {
 		code: "E_INCOMPLETE",
 		message: `compare is incomplete: ${items.join("; ")}. Nothing there was compared.`
@@ -14673,7 +15049,23 @@ function incomplete(comparison, a, b) {
 	return issue;
 }
 function uncaptured(side, address) {
-	return statusOf(side, address) === "unreadable" && coverageOf(side, objectOf(address))?.status === "read";
+	const read = coverageOf(side, objectOf(address))?.status === "read";
+	const property = parseAddress(address).type === "property";
+	const unreadable = statusOf(side, address) === "unreadable" && !opaqueGap(side, address);
+	return property && unreadable && read && settlingOn(side, address) === void 0;
+}
+function waitFix(side, comparison) {
+	const unknown = comparison.differences.filter((d) => d.status === "unknown").map((d) => d.address);
+	const until = unknown.flatMap((address) => settlingOn(side, address)?.until ?? []).sort(byCodeUnit).at(-1);
+	let when;
+	if (until !== void 0) when = `after ${until}`;
+	else if (unknown.some((address) => parseAddress(address).type === "association" && unnamedOn(side, address))) when = "in a few minutes, once HubSpot names the new association";
+	if (when === void 0) return [];
+	const { side: which } = side;
+	return [which.kind === "snapshot" ? `take a new snapshot of target ${sanitize(which.name)} ${when}` : `compare again ${when}`];
+}
+function settlingOn(side, address) {
+	return side.coverage === void 0 ? void 0 : settlingAt(side.coverage, address);
 }
 function coverageOf(side, key) {
 	const objects = side.coverage?.objects;
@@ -14795,6 +15187,11 @@ function dictionary(ir) {
 		""
 	];
 	lines.push(...observation ? coverageLines(observation.coverage) : [CONFIG_COVERAGE]);
+	const later = [...new Set(Object.keys(ir.resources).map((a) => parseAddress(a).type))].filter((t) => !handledType(t));
+	if (later.length > 0) {
+		const types = later.sort(byCodeUnit).map((t) => `${escapeMarkdown(t)} resources`);
+		lines.push("", `Not described here: ${types.join(", ")}, which a later version of ${bin} handles.`);
+	}
 	for (const [key, resources] of byObject(ir.resources)) lines.push("", ...objectLines(key, resources, observation === void 0));
 	if (!observation) lines.push(...overrideLines(ir.targets));
 	return `${lines.join("\n")}\n`;
@@ -14888,6 +15285,7 @@ function byObject(resources) {
 	const objects = /* @__PURE__ */ new Map();
 	for (const address of Object.keys(resources).sort(byCodeUnit)) {
 		const { type } = parseAddress(address);
+		if (!handledType(type)) continue;
 		const key = objectOf(address);
 		const entry = objects.get(key) ?? {
 			associations: [],
@@ -15192,9 +15590,11 @@ function rebuild(given) {
 		}
 	}
 	excluded.sort((a, b) => byCodeUnit(a.address, b.address));
+	const kept = Object.keys(input.state?.later?.resources ?? {}).sort(byCodeUnit);
 	const loses = input.state ? lossesOf(input.state, resources) : void 0;
 	return {
 		found,
+		kept,
 		missing,
 		stale: staleOf(input),
 		excluded,
@@ -15234,15 +15634,19 @@ function adopt(address, resource, observed, id) {
 		}
 	};
 }
-/** The new lineage's state: serial 1, as the first save of a new file has. */
-function rebuiltState(portalId, lineage, resources) {
-	return {
+/** The new lineage's state: serial 1, as the first save of a new file has, with what a later version wrote kept. */
+function rebuiltState(portalId, lineage, resources, previous = null) {
+	const state = {
 		format: "kalup.state/1",
 		lineage,
 		serial: 1,
 		portalId,
 		resources
 	};
+	return previous?.later ? {
+		...state,
+		later: previous.later
+	} : state;
 }
 function staleOf(input) {
 	const { loaded, observation, state, target } = input;
@@ -17806,9 +18210,7 @@ function FileStateStore(dir, options = {}) {
 			file,
 			fix: `another ${bin} command wrote state for portal ${next.portalId}; run ${bin} plan again`
 		});
-		const problems = validateState(next);
-		if (problems.length > 0) throw new Error(`refusing to save state that does not match kalup.state/1: ${problems[0]?.message}`);
-		const bytes = `${stableStringify(next)}\n`;
+		const bytes = stateText(next);
 		if (bytes === current) return false;
 		const temp = `${file}.tmp-${process.pid}`;
 		try {
@@ -18663,6 +19065,7 @@ async function pullTarget(ctx, pulling) {
 	const discovering = ctx.flags.discover === true;
 	const store = openStateStore(root);
 	const state = store.read(portalId, targetName);
+	const now = /* @__PURE__ */ new Date();
 	const portal = await readPortal(http, loaded, target, warnings, {
 		schemas: discovering,
 		pipelines: discovering,
@@ -18681,7 +19084,15 @@ async function pullTarget(ctx, pulling) {
 	const { layout } = loaded;
 	const files = readProjectFiles(root, layout);
 	warnings.push(...unmovedState(root, portalId));
-	const only = addressMatcher(ctx.flags.only);
+	const settle = {
+		state,
+		now
+	};
+	const seen = observePortal(portal, loaded, targetName, [], settle);
+	const settling = seen.observation.coverage?.settling ?? {};
+	warnings.push(...seen.issues.filter((i) => i.code === "W_SETTLING"));
+	const selected = addressMatcher(ctx.flags.only);
+	const only = (address) => selected(address) && !Object.hasOwn(settling, address);
 	const { next, objects, overrides } = mergeFiles(files, portal, loaded, {
 		only,
 		overrides: target.overrides,
@@ -18705,7 +19116,7 @@ async function pullTarget(ctx, pulling) {
 	if (index !== void 0) next[layout.barrel] = index;
 	const changed = Object.keys(next).filter((file) => next[file] !== files[file]).sort();
 	const after = loadFiles(next, { layout });
-	const { observation } = observePortal(portal, after, targetName, []);
+	const { observation } = observePortal(portal, after, targetName, [], settle);
 	const data = {
 		target: targetName,
 		portalId,
@@ -18727,7 +19138,8 @@ async function pullTarget(ctx, pulling) {
 			created = state === null && data.state.serial !== null;
 		}
 	}
-	let exitCode = ctx.flags.check && ctx.flags.exitCode && (changed.length > 0 || differs(objects, warnings)) ? exitCodes.differences : exitCodes.done;
+	const unsettled = seen.issues.some((i) => i.code === "W_SETTLING");
+	let exitCode = ctx.flags.check && ctx.flags.exitCode && (changed.length > 0 || differs(objects, warnings) || unsettled) ? exitCodes.differences : exitCodes.done;
 	if (incomplete) exitCode = exitCodes.error;
 	const newState = created && data.state !== void 0 ? shownPath(ctx.cwd, data.state.path) : void 0;
 	return {
@@ -19556,7 +19968,7 @@ function openJournal(stateDirectory, run, now = /* @__PURE__ */ new Date(), io =
 				outcome: entry.outcome,
 				ms: entry.ms
 			};
-			if (Object.values(line).some((value) => typeof value === "string" && keys.some((key) => value.includes(key)))) throw new Error("refusing to journal a line that holds a key");
+			if (Object.values(line).some((value) => typeof value === "string" && holdsKey(value, keys))) throw new Error("refusing to journal a line that holds a key");
 			const fd = io.openSync(path, "a");
 			try {
 				writeAll(io.writeSync, fd, `${JSON.stringify(line)}\n`);
@@ -19620,7 +20032,13 @@ async function plan(ctx) {
 async function planTarget(http, input) {
 	const { loaded, portal, root, take, target } = input;
 	const state = openStateStore(root).read(portal.portalId, target);
-	const { observation, issues } = await observeTarget(http, loaded, target, { associationIds: associationIds(state) });
+	const { observation, issues } = await observeTarget(http, loaded, target, {
+		associationIds: associationIds(state),
+		settle: {
+			state,
+			now: /* @__PURE__ */ new Date()
+		}
+	});
 	issues.push(...unfinished(state?.lastApply), ...unmovedState(root, portal.portalId));
 	const reads = planReads({
 		loaded,
@@ -20325,7 +20743,14 @@ async function compare(ctx) {
 	for (const side of opened) if ("http" in side) await guardPortal(side.http, side.guard);
 	const observations = [];
 	for (const side of opened) if ("http" in side) {
-		const read = await observeTarget(side.http, project?.loaded, side.name);
+		const state = openStateStore(project.root).read(side.guard.portalId, side.name);
+		const read = await observeTarget(side.http, project?.loaded, side.name, {
+			associationIds: associationIds(state),
+			settle: {
+				state,
+				now: /* @__PURE__ */ new Date()
+			}
+		});
 		issues.push(...read.issues);
 		observations.push(read.observation);
 	} else observations.push(side.observation);
@@ -21186,7 +21611,14 @@ async function snapshot(ctx) {
 	const { name: target, via } = await resolveTarget(ctx, loaded.config);
 	const { http, guard } = connect(root, loaded, target, warnings);
 	await guardPortal(http, guard);
-	const { observation, issues: read } = await observeTarget(http, loaded, target);
+	const state = openStateStore(root).read(guard.portalId, target);
+	const { observation, issues: read } = await observeTarget(http, loaded, target, {
+		associationIds: associationIds(state),
+		settle: {
+			state,
+			now: /* @__PURE__ */ new Date()
+		}
+	});
 	const observedAt = (/* @__PURE__ */ new Date()).toISOString();
 	const document = toSnapshot(observation, {
 		generator: loaded.ir.generator,
@@ -21264,8 +21696,14 @@ async function stateRebuild(ctx) {
 	});
 	const store = openStateStore(root);
 	const state = store.read(portalId, name);
-	const { observation, issues: read } = await observeTarget(http, loaded, name, { associationIds: associationIds(state) });
-	if (ctx.flags.write) requireComplete(observation, command, [...warnings, ...read]);
+	const { observation, issues: read } = await observeTarget(http, loaded, name, {
+		associationIds: associationIds(state),
+		settle: {
+			state,
+			now: /* @__PURE__ */ new Date()
+		}
+	});
+	if (ctx.flags.write) requireComplete(observation, command, [...warnings, ...read], Object.keys(loaded.ir.resources));
 	const report = rebuild({
 		loaded,
 		observation,
@@ -21280,6 +21718,7 @@ async function stateRebuild(ctx) {
 		missing: report.missing,
 		stale: report.stale,
 		excluded: report.excluded,
+		...report.kept.length > 0 ? { kept: report.kept } : {},
 		...report.loses ? { loses: report.loses } : {},
 		written: false
 	};
@@ -21299,7 +21738,7 @@ async function stateRebuild(ctx) {
 	const lock = await acquirePortalLock(portalId, { command: "state rebuild --write" });
 	try {
 		sameState(state, store.read(portalId, name), portalId, command);
-		const written = replaceState(store, portalId, report.resources, command);
+		const written = replaceState(store, portalId, report.resources, command, state);
 		Object.assign(data, written, { written: true });
 	} finally {
 		lock.release();
@@ -21315,9 +21754,9 @@ async function stateRebuild(ctx) {
 * Archives the portal's state file, when it has one, and writes a new lineage holding `resources`. The caller holds the
 * portal lock and has checked the file is the one it showed. `command` is the one to run again after a failed save.
 */
-function replaceState(store, portalId, resources, command) {
+function replaceState(store, portalId, resources, command, previous) {
 	const archived = store.archive(portalId, "state rebuild");
-	const next = rebuiltState(portalId, store.newLineage(), resources);
+	const next = rebuiltState(portalId, store.newLineage(), resources, previous);
 	try {
 		store.write(next, null);
 	} catch (error) {
@@ -21353,12 +21792,35 @@ function sameState(shown, now, portalId, command) {
 	});
 }
 /**
-* E_INCOMPLETE when the read left out a list config needs: a rebuild would drop every entry there, created origins and
-* bases included, though it could not check them. Nothing has been written. The report alone still runs.
+* E_INCOMPLETE when the read left out what config names: a list it needs, a property it could not capture, a resource
+* settling after an apply, or an association a type HubSpot does not name yet may be. A rebuild would drop every entry
+* there, created origins and bases included, though it could not check them. What settles or is unnamed where config
+* names nothing stops nothing. Nothing has been written. The report alone still runs.
 */
-function requireComplete(observation, command, issues) {
+function requireComplete(observation, command, issues, named) {
 	const { coverage } = observation;
 	if (coverage === void 0 || coverage.complete) return;
+	const { unread, scopes } = unreadOf(coverage);
+	const { settling, unnamed } = waitingOn(observation, named);
+	const until = settling.map(([, s]) => s.until).sort()[settling.length - 1];
+	const items = [
+		...unread,
+		...settling.map(([address, s]) => `${sanitize(address)} (settling after an apply until ${s.until})`),
+		...unnamed.map((pair) => `the associations between ${sanitize(pair)} (a type HubSpot does not name yet)`)
+	];
+	if (items.length === 0) return;
+	const fixes = [];
+	if (scopes.length > 0) fixes.push(`add the scope${scopes.length > 1 ? "s" : ""} ${scopes.join(", ")} to the write key, then run ${command} again`);
+	else if (unread.length > 0) fixes.push(`fix what the issues that follow name, then run ${command} again`);
+	if (until !== void 0) fixes.push(`run ${command} again after ${until}`);
+	else if (unnamed.length > 0) fixes.push(`run ${command} again in a few minutes, once HubSpot names the new association`);
+	throw new KalupError([{
+		code: "E_INCOMPLETE",
+		message: `the read did not cover everything config names: ${items.join("; ")}. A rebuild would drop what it could not check. Nothing was written.`,
+		fix: fixes.join("; ")
+	}, ...issues]);
+}
+function unreadOf(coverage) {
 	const unread = [];
 	const scopes = /* @__PURE__ */ new Set();
 	for (const [object, c] of Object.entries(coverage.objects)) {
@@ -21367,13 +21829,13 @@ function requireComplete(observation, command, issues) {
 			if (c.missingScope !== void 0) scopes.add(c.missingScope);
 		}
 		if (c.unaddressable !== void 0) unread.push(`${c.unaddressable.map((n) => `property:${object}/${sanitize(n)}`).join(", ")} (a group name no address can hold)`);
+		if (c.pipelines?.status === "unreadable") unread.push(`the pipelines of ${object}`);
+		for (const [other, pair] of Object.entries(c.associations?.with ?? {})) if (pair.status === "unreadable") unread.push(`the labels from ${object} to ${other}`);
 	}
-	const add = scopes.size > 0 ? `add the scope${scopes.size > 1 ? "s" : ""} ${[...scopes].join(", ")} to the write key` : "fix what the issues that follow name";
-	throw new KalupError([{
-		code: "E_INCOMPLETE",
-		message: `the read did not cover everything config names: ${unread.join("; ")}. A rebuild would drop what it could not check. Nothing was written.`,
-		fix: `${add}, then run ${command} again`
-	}, ...issues]);
+	return {
+		unread,
+		scopes: [...scopes]
+	};
 }
 /** The report as lines a person reads. Every portal string is sanitized. */
 function reportLines(report, total, state, path) {
@@ -21387,6 +21849,7 @@ function reportLines(report, total, state, path) {
 	};
 	for (const s of report.stale) lines.push(`  stale entry: ${s.address} (${why[s.reason]}${s.id === null ? "" : `, records ${sanitize(s.id)}`})`);
 	for (const e of report.excluded) lines.push(`  not adopted: ${e.address} (${e.reason})`);
+	for (const address of report.kept) lines.push(`  kept as it is: ${sanitize(address)} (a later version of ${bin} manages it)`);
 	return lines;
 }
 /** The config resources a rebuild can adopt. */
@@ -21774,8 +22237,11 @@ async function targetRebind(ctx) {
 		const store = openStateStore(root);
 		store.read(from, name);
 		const current = store.read(portalId, name);
-		const { observation, issues: observed } = await observeTarget(http, loaded, name);
-		requireComplete(observation, command, [...warnings, ...observed]);
+		const { observation, issues: observed } = await observeTarget(http, loaded, name, { settle: {
+			state: current,
+			now: /* @__PURE__ */ new Date()
+		} });
+		requireComplete(observation, command, [...warnings, ...observed], Object.keys(loaded.ir.resources));
 		const report = rebuild({
 			loaded,
 			observation,
@@ -21789,7 +22255,7 @@ async function targetRebind(ctx) {
 			`${CONFIG} gets portalId ${portalId}; the state file of portal ${from} is archived; plans saved for portal ${from} no longer apply.`
 		]);
 		await confirmTarget(ctx.prompt, name, "Type the target name to rebind it:");
-		const written = replaceState(store, portalId, report.resources, command);
+		const written = replaceState(store, portalId, report.resources, command, current);
 		writeStaged(root, { [CONFIG]: configText });
 		const archived = store.archive(from, "target rebind");
 		const data = {
@@ -21803,6 +22269,7 @@ async function targetRebind(ctx) {
 			missing: report.missing,
 			stale: report.stale,
 			excluded: report.excluded,
+			...report.kept.length > 0 ? { kept: report.kept } : {},
 			...archived === null ? {} : { archived }
 		};
 		const lines = [